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Abstract 

Quantum key distribution (QKD) relies on quantum and classical procedures in or- 
der to achieve the growing of a secret random string — the key — known only to the 
two parties executing the protocol. Limited intrinsic efficiency of the protocol, imperfect 
devices and eavesdropping produce errors and information leakage from which the set of 
measured signals — the raw key — must be stripped in order to distill a final, information 
CT" 1 theoretically secure, key. The key distillation process is a classical one in which basis 

reconciliation, error correction and privacy amplification protocols are applied to the raw 
key. This cleaning process is known as information reconciliation and must be done in a 
fast and efficient way to avoid cramping the performance of the QKD system. Brassard 
and Salvail proposed a very simple and elegant protocol to reconcile keys in the secret- 
key agreement context, known as Cascade, that has become the de-facto standard for all 

\ jr} , QKD practical implementations. However, it is highly interactive, requiring many com- 

munications between the legitimate parties and its efficiency is not optimal, imposing an 
early limit to the maximum tolerable error rate. In this paper we describe a low-density 
parity-check reconciliation protocol that improves significantly on these problems. The 

p^, ' protocol exhibits better efficiency and limits the number of uses of the communications 

channel. It is also able to adapt to different error rates while remaining efficient, thus 
reaching longer distances or higher secure key rate for a given QKD system. 
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1 Introduction 

A quantum key distribution protocol is composed of two parts: a quantum and a classical 
one Q]. The quantum part involves the actual transmission of qubits, its manipulation 
and detection, and it is performed using a quantum channel. The classical part is done 
through a public, albeit integrity-preserving, classical channel and involves basis recon- 
ciliation, error correction and privacy amplification protocols. The quantum part results 
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2 Information Reconciliation for QKD 

in the production of a raw key at both ends of the quantum channel. The raw key must 
be cleaned from all the unavoidable errors produced in this part. These include the 
intrinsic ones, due to the limited efficiency of the protocol, and those arising either from 
the inevitable imperfections in the physical setup or from eavesdropping. Intrinsic errors 
are easier to correct and this is usually done by bookkeeping of the detection events 
and subsequent discussion over the classical channel about the preparation state of the 
qubits leading to the recorded events. For example, in the standard BB84 protocol [2], 
half of the qubits detected by Bob will be in a base orthogonal to the one in which they 
were prepared by Alice, leading to a 50% of detections that do not directly contribute 
bits to the final secret key. In a real setup, the remaining bits will still be affected from 
errors arising either from the physical implementation itself or from an eavesdropper, 
these being in principle indistinguishable. The process to clean the key from the errors 
is known as information reconciliation and is done through the classical channel. 

The existence of optimal, although inefficient, protocols leaking a minimum of in- 
formation in the process was demonstrated in [3]. There, a practical protocol trading 
an acceptable amount of leaked information for efficiency was also proposed. This rec- 
onciliation protocol, known as Cascade, has become the de-facto standard for all QKD 
practical implementations. However, it has several shortcomings that make it less than 
ideal under certain situations that are expected to become more common in real world 
environments. Work has been done to improve on Cascade 4 - Jj , but none of the resulting 
methods have become as widespread. 

Recent advances in QKD systems have seen a tremendous increase in key generation 
speed 8 10 . Current generation systems can be successfully used over longer distances or 
in noisier environments than before, like those arising when integration with conventional 
networks is required [111112] , This changes indicate that the reconciliation protocol must 
be efficient at high key and error rates. 

Cascade is a highly interactive protocol that requires a high number of uses of the 
public channel to proceed. The number of uses raises markedly with the quantum bit 
error rate (QBER), thus it is not well suited for next generation QKD systems. From 
a practical point of view, the protocol must be implemented using two computers at 
both ends of the quantum channel that process the key and communicate through the 
public channel. The typical access latencies to the network are much higher than CPU 
operations, hence it is easy to produce a bottleneck in highly interactive protocols. In 
fact, if a specialised communications network is not used, the communications needs of 
Cascade are already the limiting factor in many situations and with current systems, 
instead of the much more delicate quantum part. On the other hand, a less than ideal 
efficiency limits the maximum number of errors that can be corrected without publishing 
too much information, thus reducing the performance of the system when working at a 
high error rate. 

In this paper we describe a reconciliation protocol that overcomes these problems. 
The protocol exhibits a better efficiency than Cascade, it can be adapted to a varying 
QBER with a low information leakage, extending the usable range of the system. It 
limits the number of uses of the public channel and its structure allows for a hardware 
implementation, avoiding communications and CPU bottlenecks, thus being well suited 
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to next generation QKD systems in demanding environments. LDPC codes also have an 
structure that make them well suited for hardware implementations 

The paper is organised as follows: In Section[2j the information reconciliation problem 
in the secret-key agreement context is described and the current status of error correc- 
tion in QKD is discussed. A new Information Reconciliation Protocol able to adapt to 
different channel parameters is presented and its asymptotic behavior discussed in Sec- 
tion [3] In Section [4] the results of a practical implementation of the protocol are shown. 
In particular the efficiency of the protocol is compared to its optimal theoretical value 
and to Cascade. 

2 Problem statement 

2.1 Information reconciliation 

Let Alice and Bob be two parties with access to dependent sources identified by two 
random variables, X and Y respectively. Information reconciliation is the process by 
which Alice and Bob extract common information from their correlated sources. In a 
practical setting Alice and Bob hold x and y, two n-length strings that are the outcome of 
X and Y , and they will agree in some string s = /(x, y) through one-way or bidirectional 
conversation [13]. The conversation </>(x, y) is also a function of the outcome strings, and 
its quality can be measured by the number of symbols involved in the conversation 
M=|0(x,y)|. 

Now, the problem of encoding correlated sources is a well known problem in infor- 
mation theory. To independently encode X and Y at least a rate R > H(X) + H(Y) 
is needed. However, in their seminal paper, Slepian and Wolf [14] demonstrated that 
to jointly encode both variables it is enough with a rate R > H(X, Y) even if X and 
Y are encoded separately. Moreover, if Y is available at the decoder only a rate of 
R > H(X\Y) is needed to encode X (see Fig.[l}, which in the information reconciliation 
context amounts for the minimum information needed in order to reconcile Alice's and 
Bob's strings. To measure the quality of a real reconciliation schema, that in a practical 
setting will encode X with a higher rate than H(X\Y), we use the efficiency parameter 
/ > 1 defined as: 

/real = fH{X\Y) > Jopt (1) 

where 7 rea i is the information published during the reconciliation process, J op t is the min- 
imum information that would allow to reconcile Alice's and Bob's strings, and H(X\Y) 
is the conditional Shannon entropy. 

However, there are two other parameters to consider when evaluating the quality of 
a information reconciliation procedure: that is the computational complexity and the 
interactivity. The first one stresses that a real information reconciliation procedure must 
be feasible. Any sufficiently long random linear code of the appropriate rate could solve 
the problem [15], however optimal decoding is in general an NP-hard problem. The 
interactivity of a reconciliation protocol has to be taken into account because, specially 
in high latency scenarios, the communications overhead can pose a severe burden on the 
performance of the QKD protocol. 
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Fig. 1. Source coding with side information. 



In order to evaluate the quality of the reconciliation, we will concentrate in discrete 
variable QKD protocols even if the ideas presented here can be easily extrapolated to 
other scenarios. Most QKD protocols encode the information in discrete variables [21116] . 
although there are many proposals on continuous variable protocols [17H19] . Errors 
on the quantum channel are normally uncorrelated and symmetric or, if prior to the 
reconciliation Alice and Bob apply a random permutation, they can behave as such [20] , 
In this situation Alice's and Bob's strings can be regarded as the input and output of a 
binary symmetric channel (BSC), characterized by the crossover probability e, and the 
efficiency parameter / can be described as the relationship between the length of the 
conversation M — |0(x, y)| and the optimal value N ■ H(X\Y) — N ■ h(e): 



f = 



M 



(2) 



N ■ h(e) 

It was first shown in [21] that low-density parity-check (LDPC) codes used within 
Wyner's coset scheme [151122] are a good solution for the compression of binary sources 
with side information. LDPC codes [26] are linear codes that have a sparse parity check 
matrix. These codes, when decoded with the belief propagation algorithm, can perform 
very close to the theoretical limit. 

The fundamental idea is to assign each source vector to a bin from a set of 2 H ^ X ' Y ' +L 
known bins, the encoder describes the bin to the decoder, and the decoder searches for 
the source vector inside the described bin. Let x and y be two binary strings of length 
n, and C a [n, k] binary linear code specified by its parity matrix H . The syndrome s 
of a vector x is the n — k string defined as s = Hx being s = for all the codewords 
in C. Each syndrome s defines a coset C s as the set of all strings, {x}, that verify 
H~x. = s. Wyner's schema consists in assigning each source vector to one of the cosets of 
C. Encoding x amounts then to compute its syndrome, and decoding is simply to find 
the member in C s closest to y. An LDPC message passing decoder was modified in |21j 
to take into account the syndrome decoding proposed by Wyner. This same procedure 
can be applied to the QKD scenario. 

2.2 Previous work 

As mentioned in the introduction, the most widely used and best known protocol for 
error correction in the QKD context is Cascade. Proposed by Brassard and Salvail [3], 
this protocol runs for a fixed number of passes. In each pass, Alice and Bob divide their 
strings into blocks of equal length. The initial block length depends on the estimated 
error probability, p, and it is doubled when starting a new pass. For each block they 
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compute and exchange its parity. A parity mismatch implies an odd number of errors, 
and a dichotomic search allows both parties to find one of the errors. Whenever an error is 
found after the first pass, it uncovers an odd number of errors masked on the preceding 
passes and the algorithm returns to correct those errors previously undetected. This 
cascading process gives name to the protocol. Several papers propose improvements on 
Cascade [I][5], these papers analyse how the block length is to be chosen and increased 
in order to optimise the efficiency of the reconciliation, but the main characteristics 
remain unaltered. Cascade, although highly interactive, is reasonably efficient and easy 
to implement. It is well known and has become the de-facto standard, hence we have 
chosen Cascade as the benchmark to compare against. 

Winnow [6] is another well know reconciliation protocol in the QKD context, it 
requires only two communications between the parties. In the first communication Alice 
and Bob exchange the parities of every block. After that, they exchange the syndrome 
of a Hamming code for correcting single errors in each block with a parity mismatch. 
The protocol incorporates a privacy maintenance procedure by discarding one bit per 
parity revealed (i.e. m bits are discarded when a syndrome of length m is exchanged). 
Its main advantage is a reduction on the number of communication needed, however the 
efficiency of the protocol is worse than that of Cascade in the error range of interest. 
Recently, some interesting improvements have been proposed for selecting an optimum 
block length in this protocol [7]. 

Modern coding techniques have not been applied to discrete variable QKD until 
recently. LDPC codes were proposed and used on [23]. But as the codes had not been 
specifically designed for the problem, aside from the inherent advantage of forward error 
correction, the efficiency was worse than that of Cascade. These codes have been also used 
in the context of continuous variable QKD [19] . LDPC codes were first optimized for the 
BSC on [24], and although the results were close to optimal for the designed codes, the 
efficiency curve exhibited a saw behaviour due to a lack of information rate adaptability 
in the proposed procedure [27] . Since the error rate can vary among transmissions, it is 
important for a protocol to be able to cope with this change. 

3 Rate-compatible reconciliation 

Although linear codes are a good solution for the reconciliation problem, since they 
can be tailored to a given error rate, their efficiency degrades when it is not known 
beforehand. This is the case in QKD, where the error rate is an a priori unknown that is 
estimated for every exchange. The QBER might vary significantly in two consecutive key 
exchanges, specially when the quantum channel is transported through a shared optical 
fibre that can be used together with several independent classical or quantum channels 
that can add noise. To address this problem there are two different options: (i) it is 
possible to build a code once the error rate has been estimated, and (ii) a pre-built code 
can be modified to adjust its information rate. The computational overhead would make 
the first option almost unfeasible except for very stable quantum channels, something 
difficult to achieve in practise and impossible in the case of a shared quantum channel 
in a reconfigurable network environment [11]. In this paper we propose the use of the 
second strategy as the easiest and most effective way to obtain a code for the required 
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rate, for which we describe a protocol that adapts pre-built codes in real time while 
maintaining an efficiency close to the optimal value. 

3.1 Rate modulation 

Puncturing and shortening are two common strategies used to adapt the rate of a linear 
code. This process of adapting the information rate of a pre-built code will be referred as 
rate modulation. When p punctured symbols of a codeword are removed, a [n, k] code is 
converted into a [n—p, k] code. Whereas, when shortening, s symbols are removed during 
the encoding process, and a [n, k] code is converted into a [n — s,k — s] code. A graphical 
representation, on a Tanner graph, of the procedures just described for puncturing and 
shortening and its effects on the rate of the sample code is shown in Fig. [2] 
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Fig. 2. Examples of puncturing and shortening strategies applied to a linear code represented by 
its Tanner graph. In the puncturing example (left) one symbol is deleted from the word and a [8,4] 
code, with rate R = 1/2, is converted to a [7,4], increasing its rate to R = 4/7. In the shortening 
example (right), one symbol is deleted from the encoding and the same [8,4] code is converted to 
a [7,3] code, the rate now decreases to R = 3/7. 



These procedures may be regarded as the transmission of different parts of the code- 
word over different channels (see Fig. [3}. Since puncturing is a process by which p 
codeword symbols are eliminated, it can be seen as a transmission over a binary erasure 
channel (BEC) with erasure probability of 1, BEC(l). Shortening is a process by which 
s codeword symbols are known with absolute certainty, as such it can be seen as a trans- 
mission over a BEC with erasure probability of 0, BEC(O). The remaining symbols are 
transmitted by the real channel which in the present paper can be modelled by a binary 
symmetric channel with crossover probability e, BSC(e) 

Supposing that _Ro is the original coding rate, the modulated rate is then calculated 



R = 



Ro 



- = -^-^~ 0) 

1 — 7T — a n — p — s 

where n and a represent the ratios of information punctured and shortened respectively. 

Both strategies, puncturing and shortening, can be applied simultaneously. Given a 

[n, k] code and n' < n bits, if puncturing and shortening are applied with a constant 
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Fig. 3. Channel model. Puncturing and shortening on a LDPC code results in the division of 
the original binary symmetric channel used to reconcile Alice's x string with Bob's y into three 
different channels: a binary erasure channel with erasure probability of 1 (for the fraction 7r of 
punctured symbols), a BEC with erasure probability of (for the fraction a of shortened symbols) 
and a binary symmetric channel with crossover probability e (for the rest of the symbols). 



number d of punctured and shortened symbols, a single code can be used to protect the 
n! bits for different error rates. There are two consequences of applying a constant d: 
(i) there is a limit to the minimum and maximum achievable information rates. These 
limits, expressed as a function of 8 = d/n, define the correction interval: 



< -Rmin — 



Ro 



5 <R< Ro 



— Rn 



< 1 



(4) 



1-8 ~ -1-8 

(ii) puncturing and shortening procedures cause an efficiency loss [28 . Therefore, there 
is a tradeoff between the achievable information rates and reconciliation efficiency. 

This efficiency loss, caused by high levels of puncturing and shortening, can be avoided 
if a set of n codes Q with different information rates is used: i?o(Ci) < Ro(&) < 
-Ro(C«)- T ne target error range can then be partitioned into, [7?min(Ci)i -Rmax(Ci)] U 
[-Rmin(C2),-Rmax(C2)] U ■•• U [-Rmin (Cn) , -Rmax (Cn )] , not necessarily with the same size. The 
number of intervals depends on the width of the error rate range to cover and on the 
desired efficiency. The compromise between the width of the interval covered and the 
achieved efficiency in the one code case is transferred to a compromise between effi- 
ciency and the added complexity of managing several codes. Fig. [4] shows the computed 
efficiency thresholds for several families of codes with different coding rates. 

3.2 Protocol 

We now proceed to describe a rate-compatible information reconciliation protocol using 
puncturing and shortening techniques as described above. 

Step 0: Raw key exchange. Alice and Bob obtain a raw key by running a QKD 
protocol through a quantum channel (see Section[2|. This key exchange may be modelled 
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Fig. 4. Efficiency thresholds for different codes with information rates, i?o = 0.5, 0.6 and 0.7 as a 
function of the quantum bit error rate (QBER). Two <5 values, 0.1 (solid line) and 0.05 (dashed) 
have been used to adapt the rate for each code. As a comparison, a single code covering all of the 
QBER range of interest, with rate Ro = 0.5 and S = 0.5, is presented to show how the efficiency 
degrades for high S values, although a broader range is covered. The codes have been optimised 
using the density evolution algorithm for the BSC. The Cascade efficiency was calculated using the 
same sample size (2 X 10 5 ). The block size used in the first step, fci , is given by fci = \0.73/QBEK\ 
(optimized in 33 ) and doubled in every subsequent step k n = 2fc n _ i. The sawtooth behaviour of 
the Cascade efficiency reflects the points where k\ changes. 
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as follows. Alice sends to Bob the string x, an instance of a random variable X, of length 
£ = n — d through a binary symmetric channel with crossover probability e, BSC(e) (or a 
black box behaving as such). Bob receives the correlated string, y, but with discrepancies 
to be removed in the following steps. 

Step 1: Pre-conditions. Prior to the key reconciliation process Alice and Bob agree on 
the following parameters: (i) a pool of shared codes of length n, constructed for different 
coding rates; (ii) the size of the sample, t, that will be used to estimate the error rate in 
the communication; and (iii) the maximum number of symbols that will be punctured 
or shortened to adapt the coding rate, d = p + s — n5. 

Step 2: Error rate estimation. Bob chooses randomly a sample of t bits of y, a(y), 
and sends them and their positions, /3(y), to Alice through a noiseless channel (i.e. the 
public and integrity-preserving channel used in the classic part of a QKD protocol). 
Using the positions received from Bob, /3(y), Alice extracts an equivalent sample in x, 
a(x), and estimates the crossover probability for the exchanged key by comparing the 
two samples: 

e' = Q(x) + " (y) (5) 

Once Alice has estimated e' , she knows the theoretical rate for a punctured and short- 
ened code able to correct the string. Now she computes the optimal rate corresponding 
to the efficiency of the code she is using: R = f — f(e')h(e'); where h is the binary 
Shannon entropy function and / the efficiency. Then she can derive the optimal values 
for puncturing and shortening, p and s respectively, as: 

s = \(R - R(l - din)) ■ n\ 

(6) 
p — d — s 

Step 3: Coding. Alice creates a string x + = g(pc, a^i,m e i) of size n. The function g 
defines the n — d positions to take the values of string x, the p positions to be assigned 
random values, and the s positions to have values known by Alice and Bob. The set of 
n — d positions, the set of p positions and the set of s positions and their values come 
from a synchronised pseudo-random generator. She then sends s(x + ), the syndrome of 
x + , to Bob as well as the estimated crossover probability e'. 

This process can be regarded as jointly coding (and decoding) the original strings 
sent through a BSC(QBER) with p bits sent through a binary erasure channel (BEC) 
with erasure probability 1, and s bits sent through a noiseless channel (see Fig. [3]). 

Step 4 : Decoding. Bob can reproduce Alice's estimation of the optimal rate R, the 
positions of the p punctured bits, and the positions and values of the s shortened bits. 
Bob then creates the corresponding string y + = g(y,cr e /,n e /). He should now be able 
to decode Alice's codeword with high probability, as the rate has been adapted to the 
channel crossover probability. Bob sends an acknowledgement to Alice to indicate if he 
successfully recovered x + . 

Step 5: (Optional) Interactive decoding. If Bob does not succeed in recovering Alice's 
string, Alice can reduce the information rate of the code by revealing some r* < p of the 
punctured bits on the public channel, that become shortened bits (see Fig. [5]). Steps 3 
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Fig. 5. Protocol sequence for interactive reconciliation. The figure shows how punctured symbols 
are converted into shortened symbols in each round, thus repeating coding and decoding steps 
for different coding rates. The interactive protocol concludes when the target string has been 
reconciled or there are no more punctured symbols to be revealed. 



and 4 are then repeated, Alice computes the new syndrome and sends it to Bob, who 
tries to decode and send an acknowledge to Alice. Let p'*' and s^> be the number of 
punctured and shortened bits respectively in the i-th round of the proposed protocol, 
and r' I+1 ' the number of punctured bits to be revealed for the next round, the new 
proportion of punctured and shortened bits used for the reconciliation are calculated as 



V 



(i+i) M_ r (*+i) ands (*+D 



s^+r 



(i+i) 



respectively. These steps can be repeated 



while Bob does not find the correct string and there are punctured bits that have not 
been revealed as shortened bits, i.e. while p > 0. 



4 Simulation results 

In this section we discuss the efficiency of the rate-compatible information reconciliation 
protocol without the interactive decoding step, comparing the results of the protocol to 
regular LDPC codes as proposed in [24] and to Cascade. The purpose of this simulations 
is to highlight that the proposed protocol extends the working range in QKD, allowing to 
distill a key in a wider QBER range than previous information reconciliation protocols. 
Fig. [6] shows the efficiency, calculated as defined in Eq. (Q~|), in the reconciliation 
process simulated for three different alternatives: (i) using the Cascade protocol, (ii) 
using LDPC codes without adapting the information rate, and (iii) using LDPC codes 
adapting the information rate with the rate-compatible protocol proposed here. The 
target error range selected is [0.055, 0.11], where a high efficiency protocol is a must. Low 
QBER rates do not demand a close to optimal efficiency since other requisites, such as 
the throughput, are more critical in obtaining a high secret key rate. In order to achieve 
a efficiency close to 1, the error range [0.055, 0.11] has been divided into two correction 
intervals: -Ro(Ci) = 0-5, Ro((2) = 0.6 and 8 — 0.1. The codes have been constructed 
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using families of LDPC codes specifically optimised for the BSC. Generating polynomials 
of these families can be found in [24] , however they were not designed for shortening and 
puncturing. Taking into account these parameters in the generating polynomial design 
process would allow to cover the whole QBER range with high efficiency. 

The construction process has been also optimised using a modified progressive edge- 
growth algorithm for irregular codes with a detailed check node degree distribution [32] . 
A codeword length of 2 x 10 bits has been used. 
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Fig. 6. Computed efficiency for medium to high error rates, a typical range expected in shared 
quantum channel environments, long distances or high losses scenarios, such as in networks, and 
where obtaining high efficiency is critical. The solid line is the Cascade efficiency. Its parameters 
are the same than for Fig. [4] The dotted line represents the modulated LDPC thresholds. For 
all LDPC results shown here 5 = 0.1. The long, thick, dashed lines joined by thin dashed lines is 
the efficiency of an unmodulated code. Short dash and dash-dotted lines are the results for the 
modulated codes. Dash-dotted is for a rate Ro = 0.6 and short dash are for Ro = 0.5, triangles 
and diamonds are used to mark the computed points. The smooth and efficient behaviour of the 
modulated, rate adapted codes, as compared to the unmodulated version is to be noted. The gain 
in efficiency over Cascade allows for an extended usability range of the system at high QBER. 



The results show that there is a small price to pay for the rate adaptation. LDPC 
codes without puncturing and shortening behave slightly better near their threshold, 
however for the 8 value chosen the penalty is very small and the rate-compatible protocol 
allows to reconcile strings in all the range with / < 1.1. The unmodulated LDPC codes 
exhibit an undesirable saw behaviour that can lead to efficiencies worse than that of 
Cascade unless nrany different codes are calculated, incurring in an unacceptable penalty 
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in CPU time. The new protocol works at a much better efficiency than Cascade, that 
performs in all the tested range with / > 1.17. 

5 Conclusions 

We have demonstrated how to adapt an LDPC code for rate compatibility. The capability 
to adapt to different error rates while minimizing the amount of published information is 
an important feature for secret-key reconciliation in the QKD context, specially whenever 
it is used in long distance links or in noisy environments such as those arising in shared 
optical networks. In these demanding environments high efficiency is necessary to distill 
a key. The protocol improves on Cascade, allowing to reach efficiencies close to one while 
limiting the information leakage and having the important practical advantage of low 
interactivity: only one message is exchanged by both parties. This high efficiency allows 
to extend the working range in QKD, that is, it allows to distill a key in a wider QBER 
range than previous information reconciliation protocols. 
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